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DRE BI 


FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 04/11/2002 
To: Ottawa Attn: Legat b6 
FBIHO Attn: PE bIE 
SA 
New York 


From: San Diego 
Squad 19 


Contact: sal] (858) 499-7385 
Approved y:[ OO] 
Drafted By: [__————iditr 


Case ID #: 265A-NY-280350 (Pending) 

265A-NY-280350-SD (Pending) m 
b6 
Title: PENTTBOMB; eye 


Synopsis: Set lead for Legat to contact service providers to determine 
identity of individual using IP addresses. 


Administrative: Reference telcall between ssal en of San 
Diego and A[L___ | PENTTBOMB Team, FBIHQ, on 4/16/2002. 


Details: At approximately 3:45 p.m. on September 12, 2001, the 
Washington Field Office of the FBI was notified by the Dulles Airport 
Police that a suspicious vehicle was found at the Dulles International 
Airport located in the Hourly Lot, Row G, Dulles, Virginia. Department oi 
Motor Vehicle records were reviewed by FBI agents from the Washington 
Field Office and determined the.1988 Toyota Corolla, with California 
license plates, Vehicle Identification Number JT2AE92E9J3137546, was 
registered to Nawaf Al-Hazmi, of 8451 Mount Vernon Avenue, Lemon Grove, 
California. 


The vehicle was searched by agents of the FBI and found to 
i ription for Khalid Al-Mihdhar from 
California, a receipt for car service at 
San Diego, California, signed by Khalid Al- 
Mihdhar, and an insurance card under the name of Khalid Al-Mihdhar, 7091 
Eskstrom Avenue, San Diego, California. Subsequent investigation in San 
Diego confirmed that both Al-Hazmi and Al-Mihdhar resided in San Diego ir 


1999 and 2000. 
ALL INFORMATION CONTAINED 
HEREIN IS UNCLASSIFIED 
DATE 01-25-2007 BY 60309 AUC/TAM/MLT/LR2 Derivative 


To: Ottawa From: San Diego 
Re: 265A-NY-280350 , 04/11/2002 


On September 13, 2001, FBI agents from the San Diego Field 
Office interviewed flight instructors at the Sorbi Flight Club which is 
located at the Montgomery Airfield, San Diego, California. According to 
the flight instructors, in May of 2000, Al-Hazmi and Al-Mihdhar began 
taking flying lessons with the Sorbi Flight Club. Al-Hazmi and Al-Mihdhe 
expressed a strong interest in. flying Boeing and jet aircraft. Al-Hazmi 
and Al-Mihdhar were instructed that they would have to learn to fly 
smaller single engine aircraft first. Al-Hazmi and Al-Mihdhar took 
approximately six flying lessons at the Sorbi Flight Club. Al-Hazmi and 
Al-Mihdhar were mainly preoccupied with. learning to control the aircraft 
while airborne and took no interest in takeoffs and landings and made 
little effort to improve those flying skills. 
On September 15, 2001, Special Agents of the FBI made contact 
person named 
During an initial interview, 
citizen of Yemen, was raised in Saudi Arabia, and entered the United 
States in 1998 on a student Hie |) = ee remained silent when asked 
if he knew Al-Hazmi and Al-Mihdar. He denied knowledge of the terrorist 
Se 11, 2001. During subsequent interviews with 
on September 15 and 16, 2001, S Jacmittes knowing AJ 
me 


Hazmi and Al-Mihdhar and advised that he ha em at a local Mosque 








approximately eighteen months ago and regularly prayed there with them. 
C N eraimed that he regularly gave them English lessons and 


attempted to help them adjust to life in the United States. In July of 
2000, he m j partment located 
California recalled that Al-Hazmi and Al-Mihdhar were still 
listed on the lease at that time but were preparing to move out. 

said that in December 2000 he moved into a residence located 
at after Al-Hazmi and 
Al-Mihdhar moved out of the residence. 


On September 15, a (ee es lereaneed Special Agents of 


the FBI consent to search his room and his home computer at the 
The San Diego Regional Computer Forensics 

Laboratory ("RCFL") subsequently performed a forensic analysis of 

computer. The RCFL uncovered several web pages on the 
computer's hard drive which expressed strong anti-American sentiments. 
These web pages contained headlines such as "America's Campaign to Destrc 
Islam," "U.S. & Britian Kill Muslim Children In Genocide Attempt," and "Z 
Message From Bin Laadin[sic]: Declaration of War." There were also sever 
web pages in support of the Muslims and their war against the Russians ir 
Chechnya. Digital records from computer revealed the email 
address MOHDAR78@HOTMAIL.COM. 


Investigation at Grossmont-Cuyamaca Community College District, 
8800 Grossmont College Drive, El Cajon, California by the FBI revealed 
that the email address, MOHDAR78@HOTMAIL.COM, was provided by Mohdar 
Abdullah as a point of contact. 











To: Ottawa From: San Diego 
Re: 265A-NY-280350 , 04/11/2002 


On September 19, 2001, Special Agents from the FBI interviewed 
Mohdar M. Abdullah of 1415 E. Lexington Avenue, Apartment Number 146, El 
Cajon, California regarding his association with Al-Hazmi and Al-Mihdhar. 
Abdullah related that he met Al-Hazmi and Al-Mihdhar in 1999 in San Diegc 
California. Omar Al-Bayoumi asked Abdullah to become acquainted with Al- 
Hazmi and Al-Mihdhar and to acclimate them the area and assist in any way 
in their affairs. Abdullah assisted Al-Hazmi and Al-Mihdhar in arranging 
travel arrangements and flight lessons while in San Diego, California. Ir 
early 2001, Al-Hazmi telephonically contacted Abdullah and informed him 
that Al-Hazmi was in Arizona attending flight school. 


On September 21, 2001, a Federal material witness warrant, 
pursuant to Title 18, United States Code, Section 3144, was issued in the 
Southern District of New York for Abdullah's detention. On September 21, 
2001, Abdullah was arrested as a material witness in San Diego, Californi 
and transferred to New York on September 25, 2001. 


On October 5, 2001, Abdullah was interviewed by Agents of the 
FBI in conjunction with a Grand Jury investigation in the Southern 
District of New York. Abdullah was shown and acknowledged writing a 
document that contained references to Stinger anti-tank weapons, 
"martyrs," "mortors,", and "grenade launchers." Abdullah further explaine 
that the document reflected his interest in weaponr which was spawned 
through his relationship with an individual named ri 


Abdullah advised that he and had utilized an indoor 
shooting range in El Cajon, California. of 
Abdullah and attended the Al Ribat mosque in the San Diego area. ullat 


also knew and stated that he was a veteran of 
the Unite tates Navy. 


Subsequent investigatio j ited States Navy has 
revealed that an individual named was previously enlisted 
in the Navy and had received small arms weapons training. 


On September 22, j BI exe da 
Federal search warrant at 
Subsequent to the search, a computer was identified by a resident of the 


address, [  _____] as having been used frequently by Abdullah. 


A separate Federal search warrant was acquired for this 
computer, which was then forensically reviewed by the RCFL. Located on 
this computer was an email message dated August 12, 2001, from 

with the subject line "SALAAM U 
PONSE NEEDED.." In the message, 
said "PLEASE TALK TO THE BROTHERS IN SAN DIEGO AS MANY AS Y OU CA 
COLEN POWELL STATED TODAY THAT THE US WAS COMMITED TO MOVING THE EM BASS) 
TO JERUSELEM WE MUST ORGANIZE A MASSIVE PROTEST OF THI S STANCE WE NEED 


PRESS COVERAGE." The message was sent = a Furthe 
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To: Ottawa From: San Diego 
Re: 265A-NY-280350 `, 04/11/2002 


investigation revealed that numerous individuals used the seized compute) 
to perform a myriad of functions, including checking email. 


Special o BE |e that based on discussion 
with agents working Domestic an nternational Terrorism, the alleged 
terrorists involved in the attacks on the World Trade Center Towers and 
Pentagon collaborated and communicated with a network of individuals and 


organizations to facilitate their attacks. It is believed that they usec 
the Internet, including email accounts to communicate with associates. 


FBI analysis of the business records and email activity 
obtained in the investigation to date indicates that some of the 19 
suspected hijackers used the internet to further their criminal conduct. 
For example, at least 12 of the suspected hijackers purchased airline anc 
other tickets over the internet using email and giving email addresses as 
contact and confirmation points for their reservations. The tickets for 
the hijacked flights that were purchased using email addresses were all 
purchased between August 25 and August 29, 2001, further indicating that 
the hijackers had closely, and secretly, communicated to coordinate thei: 
scheme. 


Upon reviewing the contents N Hotmail 
account, agents of t T an email dated 
01/18/2 P TO that contained 
statements relating to possible terrorist activities. The communication 
contained, in part, the following statements: 
"before, our plan was to go to the U.S, we would have a few 
people ready to plant bombs in very important buildings" 
The communication specifies as targets; the White House, NASA, the UN 
Headquarters and the Canadian Parliament Building, among others. It goes 
on to say that "All this sounds impossible, but anything is possible". 


The aut al ts the recipients of the email to respond to the 
en en tell him what they think of the plan. 

A 2703(d) Court Order was served on MSN Hotmail for records 
relating to the account The results showed that 
the account was accessed From a number o addresses. MSN Hotmail keer 
a record of every login to a Hotmail account and what IP address was usec 
for that login. An IP address is a unique number assigned to each 
computer on the Internet. The physical equivalent would be a telephone 


number with country and area code. The subscriber records can be obtaine 
for an IP address just as with a telephone number. 


The following IP addresses were used to access the 





To: 
Re: 


Ottawa From: 
265A-NY-280350 


IP 


San Diego 
, 04/11/2002 


Time (Pacific) 


Date 
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To: Ottawa From: San Diego 
Re: 265A-NY-280350 , 04/11/2002 


sa_______  ]queriea a publicly accessible database for 
information o ‘esses used to access the Hotmail account. The 
address block is owned by: 


“bo 
b7C 


The address block off jis owned by: 


The above list points of contact can be contacted to determine 


the identity of the person using each IP address at the specified date ar 
time. 


To: Ottawa From: San Diego 
Re: 265A-NY-280350 , 04/11/2002 


LEAD (s): 
Set Lead 1: 
OTTAWA 
AT OTTAWA 
Liaison with Canadian officials to have the following companies 


contacted to determine the identity of the individual who used the IP 
addresses at the specified dates and times: 


All IP addresses beginning with| | 


b6 
EIC 


All IP addresses beginning with| | 
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Connections of San Diego PENTTBOMB Subjects. = ss o 
‘to the Government of Saudi Arabia | 








` Links to Saudi Government: 
-b1 
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Omar Ahmed Al-Bayoumi . 


Links to Saudi Government: 


2. Education & Financial Support: On his application for admission to a doctoral program at 
Case Western Reserve University, Al-Bayoumi stated he was employed by the Saudi Civil Aviation 
‘Administration (CAA) for 20 years and was the "Assistant to the Director of Finance, Contracts and ot Rese 
` Finance Control Division, PCA, Airways Engineering" of Dallah/AvcoTrans Arabia Company > eG 
(which is under contract to the CAA to provide aircraft operations maintenance). In 1995, Ercan : 
_ Engineering, a San Diego subcontractor of Dallah/Avco, was asked by the CAA to provide financial > 
support to Al-Bayoumi while he studied in the U.S. Ercan refused and was told its contract maybe 
jeopardized as a Tesult. Al-Bayoum told NS¥ that the CAA pays him $5,000 per month to study in » 
` England for his PhD. However, the Mabahith claims Al-Bayoumi is financing his own education. In 
a 1998 letter to Case Western Reserve University, the Royal Embassy of Saudi Arabia, National . 
Guard Office, WDC, claimed that Al-Bayoumi was a candidate for a full an from the. . 
government of Saudi Arabia. mn: 


Mailings: On 01/ 18/2001, Al-Bayoumi received a UPS package at his San m 
ee from the Saudi Embassy i in WDC. 


sg 





sgr 


described Al-Bayoumi as "associated with 
i i I "member of the 


4. Witness Rep orts: Various SD witnesses have 


the Saudi government" [ J; "a frequent traveler to Saudi Arabia" 


` „Aviation Board for Saudi Arabia"|f |}; "having regular contact with the Saudi Arabian 
Consulate in LA" (J; "making frequent trips to the Saudi Consulate during the six years he was . 


known to live in San Diego" 


; "working for the Saudi governmentto watch the actions of 


. Saudis in the U.S." C_J; inquiring about the welfare of Saudi students in San Diego 


“on a scholarship and financially supported by the Saudi government". 
` -Saudi Consulate in LA" (7___}; "a spy for the Saudi government" (hijacker Al-Hazmi as reported by 


tS. 


Shaikh), "receiving support from the Saudi Arabian Government or Saudi Airlines" (| __}, a reputed 
"Saudi Arabian intelligence officer" due to his prolific videotaping of services at the mosque 


' (Abukar); "an enginéer for the Saudi Arabian government" 


; providing a $500 checkto the SD 


Kurdish Community Islamic Center drawn on the account of the Royal Embassy of Saudi Arabia 
e of intelligence agent for the Saudi 


Arabian government 


Ken r= considered by some in the community as "some intelli 
..the Los Angeles.airport to drop off.or.pick up Saudis visiting southern California 


'frequently traveling to 


[meins 


to WDC every one to two'months" to visit the civil aviation office of the Saudi Consulate on Wyoming 
Street in WD ‘ca to others at the Islamic Center that he hasfriends/contacts in the 


Saudi Consulate in LA’ 


' individuals carried on the books of Dallah and being paid 
Saudi. Intelligence Service.to. a -on-dissident Saudis' 


ae 


a "ghost employee” of Dallah/Avco and one of" Fest 50 


“working for he 
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This document contains’ neither recommendations nor conclusions of the FBI. It is the .propecty of the FHI 
and is loaned to your agency; it and its contents are not to be distributed outside your agency. z 


SECRET 














Pe ALL INFORMATION CONTAINED oy 
È HEREIN I5 UNCLASSIFIED , $ 
a DATE 04-19-2006 BY 60309 AUC/TAM/MLT/LRZ Derivative 
U.S. Department of Justice 
Federal Bureau of Investigation 
In Reply, Fl ; ; 
ee as San Diego, California 92123 : 
File No. 8 April 15, 2002 b6 
: bic 
b7D 


OMAR AL BAYOUMI 
EMPLOYED By DALLAH AL BARAKA 





telephone number 


interviewed at 


the FBI 


It is the property of 





000000104 


This document contains neither recommendations ner conclusiens of the FBI. 
and is loaned to your agency; it and its contents are not to be distributed outside your agency. 


) 
I 
cr 
N 
i 
Hi 


